joker | 425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe
Size

54KB
MD5

c265062f9012942efb4cc71431c3252c
SHA1

63b73f6c6648fb5aa3b331580b9d7bd9bfadcda8
SHA256

425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7
SHA512

692d137740520d3354ddd81f3019b5716ba345d091f3be34464ebd1c9da458244a4ece326ca363823dcaa2a305ad10b1ccb8d0fb60e9858bda0fed88c855d742
SSDEEP

768:yeJV08uVsgHgUDpiCqFYVO+1WlC1uxEtYk9cPWfuQdiHIWrwnvXv0wWE:LaCQDDpiC4uO+1lcytyPWfutwnEwWE

Score

10^/10

joker evasion infostealer persistence trojan

Malware Config

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Executes dropped EXE 1 IoCs

pid	Process
748	inlF56E.tmp

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
3124	attrib.exe
4364	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\redload\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D4E09D76-37B0-11ED-A0EE-7EA98FCFBA26} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985149"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu430.site\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\henniu430.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2855052202"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.henniu430.site	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2855052202"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000039b8b9595dd111c26795f83ca0ce32d2ccd29a0a985c1fdfaa788074b16b2348000000000e8000000002000020000000ae4aedcc21672af8185ad88bd4e599e2259a2ccaa42cdda24960fe0e1f49a44b20000000dccc109c57564003be2df8641a490b052dad347e1a884a480410b973310f549040000000bf2bcf90564240a52f90dad76597918c5d9c13563a691124d02a564f7c009e5dd05b80c86d3b02c753dde6ec82c67d2102c1a32d330f7231d1c0dca66fb0eab0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.cnkankan.com\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.henniu430.site\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2880834221"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000b0b1575ef17ca9515b4a4c45c2324599f86e8c01dcffbfddf013031efd26ff70000000000e80000000020000200000008038938d4bec8460319bc52cb39a13d2dc36b170e2ddb9224981aced22c994e7200000009fbf5f8667448c3433a9a2ae9356ac249a8d63797986a861a3970b18d6935730400000002d17fe704387c79580d4fde83c16652867bc9c0c3b66c17769953647a24bb07790b4919d2a899edebcd84d74aea59d0caa74c548226026d120d6ee104df3cd94	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609549b7bdcbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\henniu430.site\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\cnkankan.com\Total = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985149"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0936fb7bdcbd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985149"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?s"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?s"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\redload\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
3448	IEXPLORE.EXE
3448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3348	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	99
PID 2264 wrote to memory of 3348	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	99
PID 2264 wrote to memory of 3348	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	99
PID 3348 wrote to memory of 4796	3348	cmd.exe	101
PID 3348 wrote to memory of 4796	3348	cmd.exe	101
PID 3348 wrote to memory of 4796	3348	cmd.exe	101
PID 4796 wrote to memory of 2240	4796	cmd.exe	103
PID 4796 wrote to memory of 2240	4796	cmd.exe	103
PID 4796 wrote to memory of 3160	4796	cmd.exe	104
PID 4796 wrote to memory of 3160	4796	cmd.exe	104
PID 4796 wrote to memory of 3160	4796	cmd.exe	104
PID 4796 wrote to memory of 4428	4796	cmd.exe	105
PID 4796 wrote to memory of 4428	4796	cmd.exe	105
PID 4796 wrote to memory of 4428	4796	cmd.exe	105
PID 2264 wrote to memory of 748	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	107
PID 2264 wrote to memory of 748	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	107
PID 2264 wrote to memory of 748	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	107
PID 2264 wrote to memory of 3028	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	108
PID 2264 wrote to memory of 3028	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	108
PID 2264 wrote to memory of 3028	2264	425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe	108
PID 2240 wrote to memory of 3448	2240	iexplore.exe	110
PID 2240 wrote to memory of 3448	2240	iexplore.exe	110
PID 2240 wrote to memory of 3448	2240	iexplore.exe	110
PID 4428 wrote to memory of 1856	4428	cmd.exe	112
PID 4428 wrote to memory of 1856	4428	cmd.exe	112
PID 4428 wrote to memory of 1856	4428	cmd.exe	112
PID 4428 wrote to memory of 2576	4428	cmd.exe	113
PID 4428 wrote to memory of 2576	4428	cmd.exe	113
PID 4428 wrote to memory of 2576	4428	cmd.exe	113
PID 4428 wrote to memory of 740	4428	cmd.exe	114
PID 4428 wrote to memory of 740	4428	cmd.exe	114
PID 4428 wrote to memory of 740	4428	cmd.exe	114
PID 4428 wrote to memory of 1828	4428	cmd.exe	115
PID 4428 wrote to memory of 1828	4428	cmd.exe	115
PID 4428 wrote to memory of 1828	4428	cmd.exe	115
PID 4428 wrote to memory of 3568	4428	cmd.exe	116
PID 4428 wrote to memory of 3568	4428	cmd.exe	116
PID 4428 wrote to memory of 3568	4428	cmd.exe	116
PID 4428 wrote to memory of 3124	4428	cmd.exe	117
PID 4428 wrote to memory of 3124	4428	cmd.exe	117
PID 4428 wrote to memory of 3124	4428	cmd.exe	117
PID 4428 wrote to memory of 4364	4428	cmd.exe	118
PID 4428 wrote to memory of 4364	4428	cmd.exe	118
PID 4428 wrote to memory of 4364	4428	cmd.exe	118
PID 4428 wrote to memory of 3736	4428	cmd.exe	119
PID 4428 wrote to memory of 3736	4428	cmd.exe	119
PID 4428 wrote to memory of 3736	4428	cmd.exe	119
PID 4428 wrote to memory of 4436	4428	cmd.exe	120
PID 4428 wrote to memory of 4436	4428	cmd.exe	120
PID 4428 wrote to memory of 4436	4428	cmd.exe	120
PID 3736 wrote to memory of 3640	3736	rundll32.exe	121
PID 3736 wrote to memory of 3640	3736	rundll32.exe	121
PID 3736 wrote to memory of 3640	3736	rundll32.exe	121
PID 3640 wrote to memory of 3700	3640	runonce.exe	122
PID 3640 wrote to memory of 3700	3640	runonce.exe	122
PID 3640 wrote to memory of 3700	3640	runonce.exe	122

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3124	attrib.exe
4364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe
"C:\Users\Admin\AppData\Local\Temp\425f5c826645a86557fabfebd932f9baf59f6bfcd65fed2110eb5311e6f9c7e7.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f_Mk_m_206.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3448
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
      4⤵
      PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?s"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?s"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2576
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?s"" /f
        5⤵
        
        PID:740
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:1828
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:3568
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3124
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4364
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:3700
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:4436
- C:\Users\Admin\AppData\Local\Temp\inlF56E.tmp
  C:\Users\Admin\AppData\Local\Temp\inlF56E.tmp
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\425F5C~1.EXE > nul
  2⤵
  PID:3028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

Filesize
1KB

MD5
070f4a1a4282f6ed237d657480a00cef

SHA1
101c5878081f5444d253bd38e99c27092419d6bb

SHA256
821d490055135017d5ab2197a66d7e536b3b04a85986cf8e35cc3739871c195c

SHA512
a55a2111ec5fbc6bf65634b7d4b7d041a06430a83e9c1bdc582ccafd96e552679ef48929a54c2c762c13b544bfa3da673a974dec810d6bf449079cf610ccdf3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
858B

MD5
d727e34e3f5eb5ee1ce17fe4c66bf617

SHA1
ea796e8b305510775d244f30758e125a01569626

SHA256
d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d

SHA512
ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f_Mk_m_206.bat

Filesize
54B

MD5
504490369970f1c0eb580afbcdf91618

SHA1
b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

SHA256
a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

SHA512
5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlF56E.tmp

Filesize
57.2MB

MD5
f389f33d8c0da1f6d708a7efc7e14a2f

SHA1
851f40aff2e23193c014afc36adfe328ecf2a038

SHA256
c29dc3baf299e3e137f2a50b4d07900ffef40d864dc1038291a87fc43b07a6fd

SHA512
2b31e1d59dcd6e2217ddc7aac63135a26cb41887c11e24b017a431b066ebf8fc2a608804c9c278954bb2bcbf6e4a3628b49e432f1a7c7645cb6082fcc4bd01f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlF56E.tmp

Filesize
57.2MB

MD5
f389f33d8c0da1f6d708a7efc7e14a2f

SHA1
851f40aff2e23193c014afc36adfe328ecf2a038

SHA256
c29dc3baf299e3e137f2a50b4d07900ffef40d864dc1038291a87fc43b07a6fd

SHA512
2b31e1d59dcd6e2217ddc7aac63135a26cb41887c11e24b017a431b066ebf8fc2a608804c9c278954bb2bcbf6e4a3628b49e432f1a7c7645cb6082fcc4bd01f2

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.bat

Filesize
3KB

MD5
6d11d2a05e76338b23e505f2989c43d3

SHA1
794748d878a88fd38345b667069da8a77308f79a

SHA256
a4259c57a8824a89859bfa60fc9414fb9e83c7b74ddad19c5e44e6dbe08362a6

SHA512
81acdadf4ef0fc14b7558ffda33650dd4a1bd7ea2de6c815c7f5a13be0c84c1e6507e8ee75e3d6188728f6720d169a42e8d1f1bf0b224282bad1c772a1aa85d0

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.bat

Filesize
3KB

MD5
59f4b8398bf29825791363dae2f5a9d3

SHA1
f31b475a4d7d8fe2ef42c9bbafcd96ea7fd383ae

SHA256
bd38ff4ccac7de0012fb5d575f8133590bf3ecddf93f367fe259147f625a0760

SHA512
cb05f503519fa1f070ae02b49a0b1c3c3d7258a28952cb9e22219bd6a043fbdddc8e8488704100b1fe2be159b24743eaa618d07081173d59724bd85a19f9199b

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.inf

Filesize
248B

MD5
2197ffb407fb3b2250045c084f73b70a

SHA1
3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

SHA256
a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

SHA512
b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

Download Submit
C:\Users\Admin\AppData\Roaming\redload\4.bat

Filesize
5.8MB

MD5
c9389e49b7d06510ec2573eb76df2751

SHA1
33e20a725f65e1078b38613d9b00e566fbd9c456

SHA256
6cdfb885306a03f387014d247d6e1755055e76091f29b6fedeaeaa326dd5eb84

SHA512
4c79b9dfdae92ceb54cfa97782d5db2ea5b8cb12cfb94cf8ce1d2ef1b31eb55fd6d47ea2936b2de0c9e975865aa9b9dd9756507f3377b704d523e4db50e6f9af

Download Submit
memory/2240-178-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-184-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-150-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-151-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-147-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-149-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-153-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-158-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-145-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-159-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-143-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-224-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-161-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-163-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-162-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-164-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-165-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-142-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-167-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-169-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-170-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-173-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-223-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-218-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-176-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-217-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-177-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-179-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-215-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-213-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-146-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-182-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-185-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-214-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-187-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-212-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-211-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-190-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-194-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-195-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-209-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-202-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-198-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2240-200-0x00007FF94A710000-0x00007FF94A77E000-memory.dmp

Filesize
440KB

Download
memory/2264-134-0x00000000007A0000-0x00000000007C5000-memory.dmp

Filesize
148KB

Download
memory/2264-133-0x00000000002B0000-0x00000000002B3000-memory.dmp

Filesize
12KB

Download
memory/2264-174-0x00000000007A0000-0x00000000007C5000-memory.dmp

Filesize
148KB

Download
memory/2264-132-0x00000000007A0000-0x00000000007C5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads